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ABSTRACT 

Discrete Fourier transforms (DFTs) over finite fields have 
widespread applications in error correction coding. Hence, 
reducing the computational complexities of DFTs is of great 
significance, especially for long DFTs as increasingly longer 
error control codes are chosen for digital communication and 
storage systems. Since DFTs involve both multiplications and 
additions over finite fields and multiplications are much more 
complex than additions, recently proposed cyclotomic fast 
Fourier transforms (CFFTs) are promising due to their low 
multiplicative complexity. Unfortunately, they have very high 
additive complexity. Techniques such as common subexpres- 
sion elimination (CSE) can be used to reduce the additive 
complexity of CFFTs, but their effectiveness for long DFTs is 
limited by their complexity. In this paper, we propose prime 
factor cyclotomic Fourier transforms (PFCFTs), which use 
CFFTs as sub-DFTs via the prime factor algorithm. When 
the length of DFTs is prime, our PFCFTs reduce to CFFTs. 
When the length has co-prime factors, since the sub-DFTs 
have much shorter lengths, this allows us to use CSE to sig- 
nificantly reduce their additive complexity. In comparison 
to previously proposed fast Fourier transforms, our PFCFTs 
achieve reduced overall complexity when the length of DFTs 
is at least 255, and the improvement significantly increases as 
the length grows. This approach also enables us to propose 
efficient DFTs with very long length (e.g., 4095-point), first 
efficient DFTs of such lengths in the literature. Finally, our 
PFCFTs are also advantageous for hardware implementation 
due to their regular structure. 

1. INTRODUCTION 

Discrete Fourier transforms (DFTs) over finite fields have 
widespread applications in error correction coding, which in 
turn is used in all digital communication and storage systems. 
For instance, both syndrome computation and Chien search 
in the syndrome based decoder of Reed-Solomon (RS) codes, 
a family of error control codes with widespread applications, 
can be formulated as polynomial evaluations and hence can 
be implemented efficiently via DFTs over finite fields. Imple- 
menting an A^-point DFT directly requires 0{N^) multipli- 
cations and additions, and becomes costly when N is large. 



Hence, reducing the computational complexities of DFTs has 
always been of great significance. Recently, efficient long 
DFTs become particularly important as increasingly longer 
error control codes are chosen for digital communication and 
storage systems. For example, RS codes over GF(2^'^) and 
with block length of several thousands are considered for 
hard drive lUl and tape storage 121 as well as optical com- 
munication systems |3| to achieve better error performance; 
syndrome based decoder of such RS codes requires DFTs 
of length up to 4095 over GF(2^^). Furthermore, regular 
structure of DFTs is desirable as it is conducive to efficient 
hardware implementation. 

For DFTs over the complex field, many techniques have 
been proposed to reduce the computational complexity, lead- 
ing to various fast Fourier transform (FFTs). Prime factor 
algorithm (PFA) f41 and Cooley-Turkey algorithm (CTA) |5| 
can implement an A^ -point DFT with 0{N log N) multipli- 
cations for N with a lot of small factors. The PFA was ap- 
plied to DFTs over finite fields [6|, but DFTs obtained via the 
PFA still have high multiplicative complexity. In contrast, re- 
cently proposed cyclotomic FFTs (CFFTs) |7| are promising 
due to their low multiplicative complexity. Based on efficient 
algorithms for short cyclic convolutions, CFFTs require much 
fewer multiplications at the expense of very high additive 
complexity. Properly designed common subexpression elim- 
ination (CSE) algorithms (see, for example, [8]) can greatly 
reduce the additive complexity of CFFTs for short and mod- 
erate lengths, but they are much less effective for long DFTs. 
This is because the run time and storage requirement of the 
CSE algorithm in |18| become infeasible for large lengths (say 
2047 or 4095). As a result, a simplified and less effective 
CSE algorithm was used to reduce the additive complexity of 
2047 -point CFFTs in [9J, but the additive complexity of the 
2047-point CFFTs in Q remains very high. This complexity 
issue results in a lack of efficient DFTs of very long lengths 
in the literature: to the best of our knowledge, the CFFTs 
in m is the only 2047-point DFTs, and efficient 4095-point 
DFTs cannot be found in the literature. An additional dis- 
advantage of CFFTs is their lack of structure and regularity, 
which makes it difficult to implement CFFTs in hardware ef- 
ficiently. 

In this paper, we propose prime factor cyclotomic Fourier 



transforms (PFCFTs), which use CFFTs as sub-DFTs via the 
prime factor algorithm. When the length of DFTs is prime, 
our PFCFTs reduce to CFFTs. When the length has co-prime 
factors, since the sub-DFTs have much smaller lengths, this 
allows us to use CSE to significantly reduce their additive 
complexity. In this case, although out PFCFTs have slightly 
higher multiplicative complexity than CFFTs, they have much 
lower additive complexity. As a result, our PFCFTs achieve 
smaller overall complexity than all previously proposed FFTs 
when the length of DFTs is at least 255, and the improve- 
ment significantly increases as the length grows. This ap- 
proach also enables us to propose efficient DFTs with very 
long length (e.g., 4095-point), first efficient DFTs of such 
lengths in the literature. Our PFCFTs also have a regular 
structure, which is suitable for efficient hardware implemen- 
tations. Although the PFA is also used in JS), our work is 
different in two ways: (1) the sub-DFTs are implemented by 
CFFTs; (2) CSE is used to reduce the additive complexity of 
DFTs. The reduced complexity of our PFCFTs is a result of 
these two differences. 

The rest of the paper is organized as follows. Section |2] 
briefly reviews the necessary background to make this paper 
self-contained. In Section |3] we propose our PFCFTs, and 
compare their complexity with previously proposed FFTs. 
The advantage of our PFCFTs in hardware implementation is 
discussed in Section |4] Concluding remarks are provided in 
Section|5] 

2. BACKGROUNDS 

2.1. Cyclotomic fast Fourier transforms 

Let a G GF(2') be a primitive A^-th root of 1 (this implies 
that A^|2' — 1, otherwise a does not exist). Given an A^- 
dimensional vector f = (/o, /i, • • • , /jv-i)"^ over GF(2'), 
the DFT of f is given by F = {Fq, Fi, • • • , Fn-i)'^, where 

It is shown in |7| that the DFT is given by F = ALIIf, 
where A is an A^ x A^ binary matrix, 11 is a permutation ma- 
trix, L = diag(Lo,Li, • ■ • ,L„j_i) is a block diagonal matrix 
with square matrices L/s on its diagonal, and m is the number 
of cyclotomic cosets modulo A^ with respect to GF(2). The 
i-th block Li is an nii x nii circulant matrix corresponding to 
a cyclotomic coset of size m^, which is generated from a nor- 
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Let f = nf = (f^^, fC^, • ■ • , f,'J_i)^, and f/ has a length 
of mi. The multiplication between Lj and f/ can be for- 
mulated as an rn^ -point cyclic convolution between b; — 



ill nf " nf ' r ■ ■ nf ) ^nd i[. Since m^ is usually 
small, using efficient bilinear algorithms for short cyclic con- 
volutions, Lifj' can be computed efficiently by 



L f 



b, ® f; = Q,(R,b, • P.fO = Qi(c, • P.f/) 



where P^, Qi, and R^ are all binary matrices, c^ = R^b^ is 
a precomputed constant vector, and ■ denotes an entry-wise 
multiplication between two vectors. Combining all the matri- 
ces, we get CFFTs 



F = AQ(c Pf), 



(1) 



where both Q = diag(Qo, Qi, • • • ,Qm-i) and P = 
diag(Po, Pi, • ■ • , Pm-i) are block diagonal matrices. 

The only multiplications needed in ([T]) are entry-wise mul- 
tiplication c ■ Pf , and the multiplications of binary matrices 
A, Q, and P with vectors require only additions. Imple- 
mented directly, CFFTs in ([T]) require much fewer multiplica- 
tions than direct implementation, at the expense of very high 
additive complexity. 



2.2. Common subexpression elimination 

Common subexpression elimination is often used to reduce 
the additive complexity of a collection of additions. Consider 
a matrix- vector multiplication between an A^ x il/ binary ma- 
trix M and an A/-dimensional vector x over a field F. It can 
be done with additive operations only, the number of which 
is denoted by C(M) since the complexity is determined by 
M and irrelevant with x. It has been shown that minimizing 
the number of additive operations, denoted by Copt (M), is an 
NP-complete problem ifTOl . Therefore it is almost impossible 
to design an algorithm with polynomial complexity to find the 
minimum number of additions. 

Instead of finding an optimal solution, different algo- 
rithms have been proposed to reduce C(M). The CSE al- 
gorithm proposed in |8| takes advantage of the differential 
savings and recursive savings, and greatly reduces the num- 
ber of additions in calculating Mx, although the reduced 
additive complexity, denoted by Ccse(M), is not always the 
minimum. Furthermore, the CSE algorithm in IJU is random- 
ized, and the reduction results of different runs are not the 
same. Therefore in practice, we can run the CSE algorithm 
many times and choose the best results. Using the CSE algo- 
rithm in 1 8 1, the additive complexity and overall complexity 
of CFFTs with length up to 1023 are greatly reduced. It is 
more difficult to apply the CSE algorithm in fS) to CFFTs 
of longer length. This is because though the CSE algorithm 
in [8J is an algorithm with polynomial complexity (it is shown 
that it has an 0{N^ + N^M^) complexity), its runtime and 
storage requirement become prohibitive when M and A^ are 
very large, which occurs for long DFTs. 



2.3. Prime factor and Cooley-Turkey algorithms 

The basic idea of both the PFA and the CTA is to first decom- 
pose an iV-point DFT into shorter sub-DFTs, and then con- 
struct the iV-point DFTs based on the sub-DFTs. The PFA 
assumes that N contains at least two co-prime factors, that is, 
N = N1N2, where TVi and N2 are co-prime. For any integer 
n e {0, 1, ■ • • , A^ — 1}, there is a unique integer pair (rii, ri2) 
such that < 111 < Ni, < ^2 < A^2, and n = niN2 + 
n2Ni (mod N). For any integer k e {0, 1, • • • , A^ - 1}, 
suppose ki — k (mod iVi) and k2 ~ k (mod N2), where 
Q < ki < Ni and < fc2 < A^2- By the Chinese Remainder 
Theorem (CRT), (fci , ^2) uniquely determines fc, and k can be 
represented by fc = kiN^^ N2 + k2N^^ Ni (mod TV), where 
iVf^iVi = 1 (mod A^2) andiV2"^A^2 = 1 (mod iVi). 

Let a be a primitive A^-th root of 1 . Substituting the repre- 
sentation of n and fc in a"*"', we get a"'' = (a^2)«lfcl(Q,Afl)«2fc2^ 

where a^^ and a^^ are primitive A^i-th root and A^2-th root 
of 1, respectively. The fc-th element of the DFT is given by 



Af2 -point DFT 



iVi-1 JV2-I 



^^-E(E/". 
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N2+n2Ni<^ la 



ni— n2— 



(2) 



TVi -point DFT 



Hence, the A^-point DFT is expressed based on A^i -point and 
A^2-point sub-DFTs. By first carrying out A'^i A^2-point DFT 
and then A^2 A^i -point DFT, the A^-point DFT is derived. Note 
that the A^i- and A^2-point DFTs can be further decomposed 
by the PFA, if A^i and A^2 have co-prime factors. 

The CTA differs from the PFA in that the CTA does not 
assume the factors of A^ are co-prime. The CTA also use 
different index representations of n and fc. Let A^ — N1N2, 
then n = ni +n2Ni, where < ni < A^i and < ^2 < A^2, 
and fc = fciA^2 + ^2, where < fci < A^i and < fc2 < A^2- 
The fc-th element of the DFT is given by 



Ar2 -point DFT 



iVl — ± iV2 — 1 



Nin2k2 \^nik2 N2niki 



(3) 



Ni -point DFT 



Compared with (|2]l, ^ has an extra term a"^'^^, which is 
called the twiddle factor and requires extra multiplications. 
However, the advantage of the CTA is that it can be used for 
arbitrary composite length, including prime powers to which 
the PFA cannot be applied. The CTA is often very effective 
if A^ has a lot of small prime factors. For example, A^-point 
DFTs by the CTA require 0{N log A^) multiplications if A^ is 
a power of 2. However, for DFTs over finite field GF(2'), the 
DFT lengths are either 2' — 1 or its factors, and they do not 
have many prime factors. In addition, the multiplicative com- 
plexity due to the twiddle factor is not negligible for DFTs 
over finite fields. Hence, we focus on the PFA in this paper. 



3. PRIME FACTOR CYCLOTOMIC FOURIER 
TRANSFORMS 

3.1. Difficulty with long CFFTs 

Consider an A^-point DFT. Suppose there are rn cyclotomic 
cosets modulo A^ with respect to GF(2), and the i-th coset 
consists of rrii elements. Suppose an m^-point cyclic convo- 
lution requires Ai{Tni) multiplications, then the total number 
of the multiplicative operations of implementing the A^-point 
DFTisgivenby ^™ j^ A4{rni) and the number of the additive 
operations is C(AQ) + C(P). The multiplicative complexity 
can be further reduced since some elements in the vector c in 
([T]l may be equal to 1 . We may then apply CSE to the matrices 
AQ and P to reduce C(AQ) and C(P), respectively. Since 
P — diag(Pi, P2, • • • , Pm) is a block diagonal matrix, it is 
easy to see that Copt(P) = J27Li Copt(Pi)- Thus one can re- 
duce the additive complexity of each P^ to get a better result 
of C(P). The size of P^ is much smaller than that of P, and it 
is possible to run the CSE algorithm many times to achiever 
a smaller additive complexity. However, the matrix AQ does 
not have this property, and the CSE algorithm has to be ap- 
plied directly on this matrix. When the size of AQ is large, 
the CSE algorithm in 1 8 1 requires a lot of time and memory so 
that it becomes impractical. In |9 1, the reduced complexity of 
2047-point DFT over GF(2^^) is given after simplifying the 
CSE algorithm at the expense of performance loss. For the 
same reason, it is difficult to reduce the complexity of 4095- 
point DFT over GF(2i2) by the CSE algorithm in [8J. 

3.2. Prime factor cyclotomic Fourier transforms 

Instead of simplifying the CSE algorithm or designing other 
low complexity optimization algorithms, we propose prime 
factor cyclotomic Fourier transforms by first decomposing a 
long DFT into shorter sub-DFTs and then implementing the 
sub-DFTs by CFFTs. We denote the additive (or multiplica- 
tive) complexity of an A^-point DFT over GF(2') as IC{N), 
and the algorithm is denoted in the subscription of K.. If 
A^ can be decomposed as a product of s co-prime factors 
Ni,N2,- ■ ■ , Ns, we can use the PFA to decompose the Ap- 
point DFT into A^i-, A^2-, • • • , and A^^-point DFTs. Suppose 
we use CFFTs to compute these sub-DFTs, the additive (or 
multiplicative) complexity of the A^-point DFT is given by 

^ '^ A^ 

A^PFCFt(A^) = A^PFCFt(J_J_ A^i) = E Tf^CFFT(A'^i). 

If the additive (or multiplicative) of an A^-point CFFT is 
0{N'^), the additive (or multiplicative) of the corresponding 
PFCFT is 0{N X]i=i ^i)' which can be further reduced by 
CSE. Since CSE is more effective for shorter CFFTs, the de- 
composition makes it easier to reduce the additive complexity 
of long DFTs. In |6|, the PFA is used to reduce the DFTs 
complexity, but the idea of CFFT is not used. 
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Table 1. Complexities of short convolutions 



lengths 


mult. 


add. (scheme 1) 


add. (scheme 2) 


3 


1 


6 


6 


5 


5 


21 


17 


7 


6 


31 


24 


9 


11 


51 


48 


11 


28 


106 


86 


13 


32 


125 


100 


15 


16 


90 


80 


17 


38 


153 


183 


23 


84 


335 


407 


31 


55 


338 


358 


33 


85 


420 


438 


35 


75 


407 


304 


45 


90 


481 


415 


51 


115 


641 


755 


63 


97 


791 


1038 


65 


165 


1093 


883 


73 


144 


1498 


1567 


85 


195 


1602 


1817 


89 


336 


2085 


4326 


91 


230 


1668 


1418 


93 


223 


1910 


1408 


117 


299 


2328 


2015 



Table 2. The reduced complexity for CFFTs whose lengths 
are less than 200 and are factors of 2' — 1, 4 < Z < 12. 



3.3. Complexity reduction 

We reduce the additive complexities of our PFCFTs in three 
steps. First, we reduce the complexities of short cyclic con- 
volutions. Second, we use these short cyclic convolutions to 
construct CFFTs of moderate length. Third, we use CFFTs of 
moderate length as sub-DFTs to construct our PFCFTs. 

Our first step is to obtain short cyclic convolutions 
with low complexity. Suppose an L-point cyclic convo- 
lution a*^^) (g) h''^'^ is calculated with the bilinear form 
Q(i)(R(i)a(-f') . p(-f')b(^)), we apply the CSE algorithm to 
reduce the additive complexities required in the multiplication 
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Table 3. The complexities of our PFCFTs of (2' — l)-point 
DFTs overGF(2') (4 < / < 12) for possible decompositions. 
The 31- and 127-point DFTs are omitted since our PFCFTs 
reduce to CFFTs in these two cases. 



with P(^) and Q^^^^ (the multiplication R'^^)a(^) is precom- 
puted). The additive complexities Ccse(Q^'^''), Ccse(P^^^), 
and the total additive complexity Ccse(Q^'^'') + Ccse(P*'^'') 
as well as the multiplicative complexities are listed in Tab. [T] 
The short cyclic convolution algorithms for lengths 2-9 and 
11 are from ll9l [TTl - [T3 l. and the 10-point cyclic convolution 
is built from 2- and 5-point convolutions while the 12-point 
cyclic convolution is built from 3- and 4-point convolutions. 
Convolutions with longer lengths are not needed in this paper 

The second step is to reduce the additive complexity of 
CFFTs with moderate length, which will be used to build long 
DFTs. Because of their moderate lengths, we can run the CSE 
algorithm many times and choose the best results. For any k 
so that fe|2' - 1 (4 < ? < 12) and fc < 200, the multiplicative 
and reduced additive complexity of the fc-point CFFTs are 
shown in Tab. |2l 

Two possible schemes can be used to reduce the addi- 
tive complexity of CFFTs in ([TJ, and they may lead to differ- 
ent additive complexities. Scheme 1 reduces C(AQ), while 
scheme 2 reduces C(A) and C(Q) separately. From a the- 
oretical point of view, it is easy to show that Copt(AQ) < 
Copt (A) + Copt(Q), since (AQ)x ~ A(Qx). However, this 
property may not hold for the CSE algorithm since it is not 
able to identify all the linearly dependent patterns in the ma- 
trix. We may benefit from reducing C(A) and C(Q) for the 
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Table 4. Comparison of the DFT complexity reduction results in the literature and our paper. 



following two reasons. First, Q has a block diagonal struc- 
ture, which is similar as P, therefore we can find a better 
reduction result for C(Q). Second, the size of A is smaller 
than AQ, and hence the CSE algorithm requires less memory 
and time to reduce A than to reduce AQ. The additive com- 
plexities based on schemes 1 and 2 are both listed, and the 
boldface additive complexity is the smaller one for each k. 

In the third step, we use the CFFTs of moderate lengths 
in Tab.|2]as sub-DFTs to construct long DFTs. Hence, we use 
the complexities listed in Tab. |2]to derive the computational 
complexity of the DFTs with composite lengths 2' — 1 over 
GF(2') for 4 < Z < 12. All the possible decomposition of 
2' — 1 with factors less than 200 and the corresponding mul- 
tiplicative and additive complexities are listed in Tab. [3] Note 
that for each sub-DFT, the scheme with the smaller additive 
complexity listed in Tab. |2] is used in our PFCFTs to reduce 
the total additive complexity. Since some lengths of the DFTs 
have more than one decomposition, it is possible that one de- 
composition scheme has a smaller additive complexity but a 
larger multiplicative complexity than another one. Take 4095- 
point DFT as an example. The decomposition 7 x 9 x 65 re- 
quires 91509 additions and 18910 multiplications, while the 
7 X 13 X 45 decomposition requires 21780 additions and 83305 
multiplications. Therefore a metric of the total complexity is 
needed to compare the total complexities of different decom- 
positions. In this paper, we follow |8| and assume the com- 
plexity of a multiplication over GF(2') is 2/ — 1 times of that 
of an addition over the same field, and the total complexity 
of an DFT is a weighted sum of the additive and multiplica- 
tive complexities, i.e., total = {21 — 1) x mult + add. This 
assumption is based on both software and hardware imple- 
mentation considerations |8|. Using this metric, in Tab. [3] the 
smallest total complexity for each DFT is in boldface. 



plexities due to CFFTs used for the sub-DFTs. The additive 
complexities of our PFCFTs for N — 511 and 1023 are much 
smaller due to CSE. Thus our PFCFTs have smaller total com- 
plexities than those in Q. Compared with the direct CFFT 
(DCFFT) results in |8| and |9|, for A^ > 63, our PFCFTs have 
much smaller additive complexities due to their decomposi- 
tion structure. For instance, the additive complexity of our 
PFCFTs is about half of that of the DCFFT for N = 511, and 
one third for A^ — 1023. Although the multiplicative com- 
plexities of our PFCFTs are somewhat larger than DCFFTs, 
the reduced additive complexity outweighs the increased mul- 
tiplicative complexity for long DFTs. Hence, our PFCFTs 
have smaller total complexities than CFFTs in Js) and lH for 
N > 255, and the improvement increases as A^ grows. 

When the lengths of DFTs are prime (for example, 
31-point DFT over GF(25), 127-point DFT over GF(2^), 
and 8191-point DFT over GF(2i^)), our PFCFTs reduce to 
CFFTs. Therefore, our PFCFTs and CFFTs have the same 
computational complexities in such cases. 
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Fig. 1. The circuitry of CFFTs. 



4. HARDWARE ARCHITECTURE OF OUR PFCFTS 



3.4. Complexity comparison 

For composite A^ = 2' — 1 (4 < Z < 12), the complexities of 
our PFCFTs are compared to the best DFTs in the literature 
known to us in Tab.|4] Although the FFTs in 1 14] are proved 
asymptotically fast, the complexities of our PFCFTs are only 
a fraction of those in 1 14 1. Compared with the previous PFA 
result |6|, our PFCFTs have much smaller multiplicative com- 



CFFTs have a bilinear form, and therefore their hardware im- 
plementation consists of three parts as shown in Fig.[T] The 
input vector f is first fed to an pre-addition network, which 
reorders f into f and then computes Pf. Then a multiplica- 
tive network computes the entry-wise product of c and Pf'. 
The DFT F is finally computed by the post-addition network 
which corresponds to the linear transform AQ. Although the 
structure in Fig. [T] appears simple, the two additive networks 



are very complex for long DFTs. Even with CSE, the two 
additive networks still require a large number of additions. 
Furthermore, both lack regularity and structure, making it dif- 
ficult to implement them efficiently in hardware. 

In contrast, our PFCFTs are more suitable for hardware 
implementation due to their regular structure. Since long 
DFTs are decomposed into short sub-DFTs, their hardware 
implementation becomes much easier and can be reused in 
our PFCFTs. Fig. |2] illustrates the regular structure of our 
15 -point PFCFT Instead using the circuitry in Fig. [T] for 15- 
point CFFTs, we only need to design a 3-point CFFT module 
and a 5 -point CFFT module, and our 15 -point PFCFT is 
obtained by using these two modules, as shown in Fig. |2l 
Even when the total complexity of our PFCFTs is higher than 
that of CFFTs, our PFCFTs may be considered due to their 
advantage in hardware implementation. 




Fig. 2. The regular structure of our 15-point PFCFT. 



5. CONCLUSION 

In this paper, we propose a family of fast DFTs over GF(2') 
(4 < ^ < 12) with composite lengths, called PFCFTs. Our 
PFCFTs have smaller total complexities that previously pro- 
posed FFTs when N > 255. Our PFCFTs of very long 
lengths (say 4095-point) are the only known efficient DFTs 
of such lengths. Finally, our PFCFTs also have advantages in 
hardware implementation due to their regular structure. 
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